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(54) Telecommunications system 

(57) In a telecommunications system such as a glo- 
bal mobile telephone network in which each subscriber 
unit includes a Subscriber Identity Module (SIM card), 
each SIM card has fixed memory locations (22), to 
which data can be addressed over tiie air. The locations 
(22) can be accessed from the subsaiber unit on the 
entry of short simple codes, each associated with one of 
the locations. Furtiier fixed memory locations (24) can 
be read over the air only when the subscriber enters a 
personal identification number. Also, the SIM contains 
means which are operable to act on receipt of a signal, 
from ttie user of the subscriber unit or from a host sta- 
tion, to determine and undertake an appropriate 
response to the signal. 
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Description 

This invention relates to a telecommunications sys- 
tem. In particular, but not exclusivety. it relates to a 
mobile communications system such as a cellular 
mobile radio or telephone system. 

A recent innovation in such systems has been the 
introduction of Subscriber Identity Modules (SIM cards). 
These are integrated drcuit cards which can be releas- 
ably inserted into a mobile telephone and which contain 
in memory the subscriber's identity, i.e. his telephone 
number. These known SIM cards also have a memory 
area which can store a certain number of alphanumeric 
characters. The memory area fadlitates the so-called 
Short Message Sendee (SMS) in which a message for a 
subscriber or for a specified group of subscribers can be 
broadcast over the air, as an advanced form of radiop- 
aging. Messages can be received by a mobile tele- 
phone whenever it is idle or during a call. However, if a 
message is received which would overfill the memory 
area, data is held at the host station until such time as 
the subscriber manually clears a space for it. 

US-A5 127 040 describes a metiiod and apparatus 
for remotely loading repertory telephone numbers into a 
mobile unit The numbers can be recalled and used 
later by the subscriber. 

EP-A-0 459 344 describes a method of download- 
ing and executing software in a remote terminal of a 
communications system. 

WO-A-91/12698 discloses a mobile radio tele- 
phone having a SIM card which has been programmed 
only to authorize the use of certain services. Such pro- 
gramming takes place directly and not remotely. 

It is an object of the invention to provide a more effi- 
dent and remotely reconfigurable SIM card. 

From one aspect, the present invention consists in 
a telecommunications system comprising at least one 
host station and a plurality of sut)scriber units, the or 
each host station being operable to transmit a message 
to at least one of the subscriber units, and each sub- 
scrber unit having a multiplidty of fixed memory loca- 
tions and means responsive to the detection of the 
message to store the message in a selected one of the 
fixed memory locations, which can be accessed from 
the subscriber unit when required, said memory loca- 
tions (22) being provded in an integrated circuit card (7) 
or other module which is removably connected to said 
subscriber unit, characterized in that each subscriber 
unit is adapted to transmit a signal, from the or each 
host station or the user of said subscriber unit to said 
module, said module containing means operable to act 
on receipt of such a signal to determine and undertake 
an appropriate response to said signal. 

Thus, for example, a set of telephone numbers, 
each with an identifying alphanumeric tag. can be trans- 
mitted to the SIM card, allowing users easy access to 
commonly used services such as hotels, car hire or air- 
line reservations. This feature is known as a Value 
Added Service Directory. 



A message may be retrievable by the subscriber on 
tiie entry of simple, short codes into the subscriber unit, 
each memory location corresponding to a particular 
code. A message may indude a telephone number and. 

5 once stored, may be able to be oven^n-itten over ttie air. 
Preferably, the or each host station is operable to trans- 
mit a request for information stored in a subscriber unit. 
The information may be included in a message and it 
may also indude information which is stored in a secure 

10 memory location, accessible only when the subscriber 
enters a personal identification number (PIN number). 
The information may include credit details relevant to 
ttie sut>scriber. for example, a credit card number of 
aedit status, thus greatiy facilitating credit card transac- 

is tions carried out over the telephone. Using this feature 
of ttie invention, a credit account holder avoids having to 
dictate his account details and need only enter ttie man- 
datory PIN number. 

The host station may be operable to transmit 

20 instructions to lock and/or unlock a memory location at 
the subscriber unit It may be operable to transmit 
instructions to run a program stored in memory loca- 
tions at ttie subscriber unit The host station may be 
operable to transmit files containing functional data 

25 and/or files containing non-functional data to the sub- 
scriber unit. 

The messages, requests for information and the 
instructions being transmitted may be in a specific for- 
mat which the subscriber unit is able to distinguish from 

30 other formats. The specific format may be made secure 
against interception. 

In a preferred embodiment, the subscriber unit 
comprises a mobile radio or telephone and an inte- 
grated circuit card which can be removably connected 

35 to ttie radio-telephone. The integrated drcuit card may 
contain the memory locations and may contain means 
for distinguishing the specific format from other formats. 
The card may contain means for distinguishing between 
the messages, requests for information and instruc- 

40 tions. The card may also contain the means for storing 
the messages and means for acting on the requests 
and instructions. 

From another aspect, ttie invention consists in a 
nrKxlule for controlling a subscriber unit in a telecommu- 

45 nications system comprising at least one host station, 
said module being removably connectable to a trans- 
ceiver of the subscriber unit and comprising a multiplic- 
ity of fixed memory locations, and means responsive to 
the detection of a message transmitted remotely thereto 

so to store ttie message in a selected one of the fixed 
memory locations, characterised by response means 
operable to act on receipt of a signal, from the or each 
host station or the user of sakl subscriber unit to deter- 
mine and undertake an appropriate response to said 

55 signal. 

The module may indide a drectory structure wittiin 
which files can be stored. 

The invention is particulariy applicable to global tel- 
ecommunication systems in which the mobile cellular 
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telephone networks of various countries or areas com- 
municate using a common standard. An example of 
such a global system is GSM (Global System for Mobile 
Communications) currently operating in Europe. How- 
ever the invention is not limited to global systems and 
would be applied to a single nationed cellular network or 
even to a fixed land-linked network. 

An embodiment of the invention will now be 
described by way of example with reference to the 
accompanying drawings in which:- 

Rgure 1 shows the transmission of messages to a 
subscriber unit in a system according to the inven- 
tion; 

Rgure 2 shows a process in which a sii>scn*ber unit 
transmits a message and requested information; 
Figure 3 is a block diagram showing elements of a 
module shown in figures 1 and 2; 
- Figure 4 shows details of one of the blocks shown in 
figure 3; and 

Rgure 5 is a flowchart showing the operation of the 
module shown in figures 1 to 4. 

Rgure 1 illustrates an SMS distribution path 
according to tiie invention. In the prior art. the short 
messages have usually been directed to a single sub- 
scnlDer or a specified group of subscribers such as a 
sales team. 

However, GSM also supports a feature known as 
Cell Broadcast in which messages can be sent to all the 
subscribers in a particular area. In the embodiment of 
the invention illustrated, a message consists of the tele- 
phone nurrber of an advertiser and an alphanumeric 
tag to identify the advertiser. 

An operator enters the message into a terminal 1. 
The message is then coded into a secure format known 
as an Embedded Command Stream (ECS) and sent via 
a modem 2 and a fixed tine 3 to a local GSM switch 4. 
According to its delivery address, the message is deliv- 
ered to any or all of tiie other switches wittiin tiiat net- 
work, or even across networks. 

The ^toh 4. which in this example is in ttie geo- 
graphical area to which the message Is to be transmit- 
ted, delivers tiie message to a nunrber of cellsites 5. 
The cellsites 5 are the base tiansceiver stations of the 
GSM networic 

Each cellsite 5 then broadcasts the message to a 
group of transceivers or mobile telephones, hereinafter 
referred to as "mobiles'. If Cell Broadcast is used, the 
group consists of all mobiles within the geographical 
area at the time of the broadcast 

A selected mobOe 6 receiving ttie message trans- 
mits a confirmation of receipt back to its respective cell- 
site 5. From now on, until an update situation, the 
system will not contact this mobile 6 agaia 

The mobile 6 recognizes tine message as SMS data 
and passes it to a SIM card 7, which is a small self-con- 
tained microprocessor, held in a slot in the mobile 6. 
The SIM card 7 In turn recognizes the ECS using spe- 



cial hardware and software and stores the message in 
memory in such a way that it may not be ovenwritten by 
tiie subscnlDer. Known SIM cards contain a large 
number of fixed memory locations in which tiie sub- 

5 scriber can store frequentiy dialled nunft)ers and corre- 
sponding alphanumeric tags. The SIM card 7 of the 
invention stores the message in one of these locations, 
and then carries out a write protect operation. The loca- 
tions .dedicated to storing write protected messages 

10 may be designated by code numbers relating to a par- 
ticular category of advertiser. Thus, for exanple, car 
hire conpany telephone numbers can be stored in loca- 
tion 01, hotel reservations in location 02 and so on. 
Rgure 2 shows a call placing process In which a 

75 subscriber comnuinicates with an advertiser. The sub- 
scriber, remembering that the car hire company's 
number is in location 01 as shown at 8, keys in a short 
code corresponding to the location, such as 01#. The 
mobile 6 ttien interrogates the SIM card 7 to retrieve the 

20 telephone number from the location. The SIM card 7 
provides both the number and the alphanumeric tag giv- 
ing tiie compan/s name and displays it to the sub- 
scriber. The user confirms tiiat he wishes to proceed by 
pressing SEND. 

25 Next, the mobile obtains a voice channel through 
which the call proceeds to ttie dialled number. The GSM 
system automatically handles intra-network and inter- 
network hops. At this point tiie subscriber can hoki a 
voice conversation with the company. 

30 Providing the correct equipment has been installed 
at the company, as soon as the call is answered, sub- 
scriber identity information read from the SIM card 7 
gives tiie company immediate customer billing details 
such as a name and address. 

35 The SIM card 7 also contains information detailing 
the subscriber's credit account This information is held 
in a separate, secure memory location, accessible only 
when the subscriber enters a mandatory PIN number, 
known only to himself, thus confirming that tiie mobile 

40 has not been stolen or lost When the subsaiber has 
confirmed his car hire deal, he enters the PIN number 
into the mobile 6, requesting the aedit information from 
Vie SIM card 7. The SIM card 7 supplies the information 
and the mobile uses existing voice/data techniques to 

45 transmit the information to the conrpany, in a format 
secure against detection by fraudsters. The sale is con- 
firmed by the conrpany or its equq^ment and the call is 
temninated. 

In this example, it is also possible to obtain a tele- 
50 phone or fax number from the opa'ator-assisted direc- 
tory enquiries system witiiout tiie subscriber having to 
manually enter the nuniber into the communications ter- 
minal which he desires to usa 

To use tills feature, the subscriber calls networic 
55 directory enquiries and gives the name of the person, 
company or service of which he wishes to ascertain the 
telephone number, as well as any additional information 
requested by the operator answering the call. The oper- 
ator then locates the number, confirms it and enquires 
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as to whether the number is to be transmitted verbally, 
transferred over SMS into a given mennory location of 
the subscriber's SIM card or both. 

If the subscriber chooses a SIM update, the voice 
call is terminated and the operator initiates the SMS 
process by entering a sequence into a computer or 
pressing a dedicated button. The telephone number is 
then encoded into an ECS message at the despatch 
centre and is posted across the network to the sub- 
scriber's communications terminal, which transmits a 
confirmation to the despatch centre. Thus tiie retry 
mechanism, which operates until such a confirmation is 
received, is suspended. 

The communications terminal recognises the mes- 
sage as SMS data, passes it to tiie SIM card, and if 
capable, displays a "message received" banner. The 
SIM card in turn recognizes the ECS using special hard- 
ware and software, and decodes it accordingly. The 
nurhber. and any associated alphanumeric tag, which 
would normally consist of the name of the person or 
company, are recovered together with the memory loca- 
tion in which they are intended to be stored. The 
number and name-tag are then written to that location 
and are write-protected if requested by the subscriber, 
the ovenmlte protection being encoded into tiie mes- 
sage at source. 

Subsequentiy, tiie subscriber attempts to place a 
call to the number in the known memory location by key- 
ing in the memory location number. The SIM card 
passes the telephone or fax number to the communica- 
tions terminal on demand, and upon receipt of the sub- 
scriber's confirmation, the communications terminal 
sets up the call to the desired number. 

Rgure 3 shows the electronic structure of the SIM 
card 7. The card communicates with the mobile to which 
it is connected via an input/output (I/O) manager 15, 
preferably using the protocol ISO 7816 T^o. A filter 16 
receives incoming data from the I/O manager and 
detects any ECS messages from among the short mes- 
sages received. The ECS messages are sent directly to 
an electrically erasable read only memory (E^ROM) 17, 
which is preferably a "flash" E^ROM. Data can also be 
output from the E^ROM directly to the I/O manager 15. 
The remaining blocks shown in figure 3 are standard 
components of a SIM card. 

Rgure 4 shows how the E^ROM is organized. A 
root directory 18 contains a SIM administration and 
identifier 19, a GSM directory and network data 20, and 
a telecom directory 21 . 

The telecom directory in turn contains memory 
locations as follows: "abbreviated dial numbers" 22, 
"capability configuration" 23, "short messages" 24. 
"fixed dial numbers" 25, and "charging counter" 26. 
Each block represerrts a plurality of memory locationa 
The frequently dialled numbers and corresponding 
alphanumeric tags are stored at locations 22. 

The "abbreviated dial numbers" locations 22 and 
the "short messages" locations 24 each have an asso- 
ciated locking control ffle 27. 28 respectively. The lock- 



ing control files constitute means for read/write 
protecting and removing readAwrite protection from their 
associated memory locations. The locking control files 
27. 28 will typically be in tiie telecom directory 21 as 

5 shown, however ttiey can be located elsewhere such as 
in an administration directory. 

Rgure 5 is a flowchart Illustrating tiie operation of 
tiie SIM card 7, which uses the specially fabricated 
hardware and software which has been descrflDed 

10 above to implement the operations illustrated. At loz- 
enge 9. messages, requests, and instructions having 
ECS are distinguished from those without Each of 
ttiese ECS types consists of a data stream headed by a 
command which is one of at least four types: write com- 

15 mands for the messages, read commarKis for the 
requests for information, attribute commands for lock or 
unlock instructions and run commands for instructions 
to run a program. 

The command and data types are decoded at box 

20 10 and acted on in one of the four paths 11-14. 

Path 1 1 handles the write commands to store mes- 
sages starting at a location specified therein. Path 12 
handles the read commands; again, the requests for 
information contain a location to be accessed first Suc- 

25 cessive locations are read and the data stored in a 
buffer until tiie required amount of data has been read. 
The data in the buffer is ttien encoded into tiie ECS for- 
mat and despatched from the mobile using SMS to the 
calling party. 

30 In path 13, attribute commands are used to lock or 
unlock specified memory locations and render them 
accessible or inaccessible, either to calling parties or to 
the SLi}Scriber. In patii 14, run commands cause a pro- 
gram stored in tiie SIM card to be run. 

35 The basic ECS system is expandable to up to 255 
internal shell commands of which write, read, 
lock/unlock and run are four examples. The specific pro- 
tocol used for the transfer of information is not fixed and 
could be 1S07816 T=0 or any other suitable protocol. 

40 The internal shell commands are a supplement to 
tiie ability of the system to create external file objects 
wittiin ttie SIM card 7. The file objects are of two types: 
/^plication Data Rle Programs (ADFP*s) containing 
functional data which can be executed by the SIM card 

45 processor and can self modify if required and Applica- 
tion Data Rles (ADPs) containing non-functional data 
which does not have tiiese capabiliti^. Existing 
ADF(P)*s can be modified over-tiie-air enabling 
advanced facilities such as personalisation, re-person- 

50 alisation or downloadable phone book. 

The SIM card 7 has a directory structure, similar to 
tfiat of a computer disk, and new ADF{P)'s can be 
downloaded into any directory over the air. Also over tfie 
air, directories can be created, deleted and modified, 

55 multiple tree directory operations can be carried out and 
ADF(P)'s that are no longer required can be deleted. 
The amount of /^F(P) data which can be downloaded 
is limited only by the size of the E^ROM memory of the 
card. 
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The invention, as described, greatly extends the 
applications of SIM cards. For exanple, using the Value 
Added Services Directory, subscribers can book hotels 
and airline seats over their mobiles quickly and easily. 

An additional advantage of this feature of invention s 
is that the geographical distribution of messages to 
cards in a specific area such as the South of France is 
facilitated. Thus advertisers can direct their messages 
to ail mobile subscribers in the specific area. This is par- 
ticularly useful when subscribers "roam" from one area 10 
to anottier and have no knowledge of local services. 

TTie directory enquiries download enables contact 
telephone or fax numbers to be delivered to a sub- 
scn'ber's communications terminal witiiout any interven- 
tion by tiie subscriber. The process of manually entering is 
a number whilst engaged in a call to tiie operator is 
often dangerous, especially when the subscriber is driv- 
ing. 

* The ability of the system to download ADF(P)'s 
means that additional sen^ices can be added to the SIM 20 
card over the air while maintaining total compatibility 
with tiie existing cellular system. Thus tiie SIM card 
could acquire the functions of a credit card, passport, 
driving licence, car park pass, membership card and so 
on, becoming a multiservice card. Also, dynamically 25 
updatable services can be added which require a differ- 
ent process to be run each time a service is accessed. 

Once the card has extra services on it, it can be 
used outside of the mobile phone environment if desired 
as a standalone item. This can be read from or written 30 
to by a dedicated piece of hardware, such as a point of 
sale machine. If desired, the new services can be 
deleted, however the card will never lose its mobile 
phone SIM capability In addition, if the card has extra 
services, they will continue to function even if the sub- 3S 
scrber has been disconnected from tiie mobile phone 
network, unless otherwise desired. 

Modifications are possible without departing from 
the scope of tiie invention. 

For example, tiie SIM card can be trained only to 4o 
receive messages detailing services relevant to the sub- 
scriber's needs. 

Clainis 

45 

1. A telecommunications system comprising at least 
one host station (1) and a plurality of subscriber 
units ttie or each host station being operable to 
transmit a message to at least one of the subscriber 
units, and each subscriber unit having a muKiplidty so 
of fixed memory locations (22) and means respon- 
sive to the detection of tiie message to store the 
message in a selected one of the fixed memory 
locations, which can be accessed from ttie sub- 
scriber unit when required, said memory locations ss 
{22) being provided in an integrated circuit card (7) 
or other module which is removably connected to 
said subscriber unit characterized in ttiat each sub- 
scriber unit is adapted to transmrt a signal, from the 



or each host station or tiie user of said subscriber 
unit, to said module, said nrxxJule containing means 
operable to act on receipt of such a signal to deter- 
mine and undertake an appropriate response to 
said signal. 

2. A system as claimed in claim 1 , wherein the or each 
host station (1) is operable to overwrite a message 
stored in any one of said muKiplictty of fixed mem- 
ory locations (22) at each subscriber unit. 

3. A system as claimed in claim 1 or daim 2, wherein 
each subscriber unit conprises means arranged to 
receive a signal from said module and to present 
information from said signal to the user of said sub- 
scriber unit or to transmit said signal to at least one 
of said host stati'ons. 

4. A module (7) for controlling a subscriber unit in a 
telecommunications system having at least one 
host station (1). said module (7) being removably 
connectable to a transceiver (6) of the subscriber 
unit, and comprising a multiplicity of fixed memory 
locations (22,24), and means responsive to tiie 
detection of a message tiansmitted remotely 
tiiereto to store the message in a selected one of 
the fixed memory locations, characterized by 
response means operable to act on receipt of a sig- 
nal, from ttie or each host station or the user of said 
subscriber unit to determine and undertake an 
appropriate response to said signal. 

5. A module (7) as claimed in daim 4, wherein said 
response means is ananged to request further 
information, such as a personal identification 
number (PIN). 

6. A module (7) as daimed in daim 5, wherein said 
response means includes means for conparing 
said input information with information stored in 
said module, and means for determining a 
response dependent on the outcome of said com- 
parison. 

7. A module (7) as daimed in daim 4, wherein said 
response means indudes means for running a pro- 
gram stored in said module. 

8. A module (7) as daimed in any one of claims 4 Id 7, 
wherein each memory location (22) is associated 
with a sinple. short code, and indudes means 
responsive to the entry of each code to retrieve 
da^ from the assodated memory location. 

9. A module (7) as daimed in any one of daims 4 to 8, 
wherein the or each message, request for informa- 
tion and instruction transmitted is in a spedfic for- 
mat and the module (7) indudes means (16) for 
recognising the specific format. 
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10. A module (7) as claimed in any one of claims 4 to 9, 
including means (27.28) for rendering any or all of 
said f ixed memory locations accessible or inacces- 
sible from either the subscriber unit or the host sta- 
tion. 5 

11. A module (7) as claimed in any one of claims 4 to 

10. including a directory structure (21) within which 
files can be stored. 

10 

12. A module (7) as claimed in any one of claims 4 to 

11, wherein the module is in the fonn of an inte- 
grated circuit card. 

1 3. A system as claimed in claim 1 or daim 2, compris- is 
ing a module as claimed in any one of daims 4 to 

12. 
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